docs: record production cutover freeze

docs/evidence/core-hub-railiance01-cutover-2026-08-21.md

@@ -0,0 +1,59 @@
+# Core Hub railiance01 production cutover — 2026-08-21
+
+Status: in progress; waiting for the operator-owned IONOS DNS edit.
+
+## Approved boundary
+
+The operator explicitly approved `CORE-WP-0011-T04`. This gate covers the
+bounded source write freeze, final transfer, public route change, verification
+and rollback readiness. CoulombCore resources remain intact through the later
+stabilization gate.
+
+## Freeze and final transfer
+
+- Public DNS still resolves `hub.coulomb.social` to CoulombCore
+  `92.205.130.254`; its observed TTL is 3600 seconds.
+- CoulombCore database `core_hub` now has
+  `default_transaction_read_only=on`. The source Deployment was restarted,
+  its application role reports `transaction_read_only=on`, and public health
+  and readiness remain HTTP 200.
+- Frozen full-archive SHA-256:
+  `4015ad622303ba206a46627ba0d03513e1054b95b87247d61cce6cb6b94189e6`.
+- The data-only transfer contained eight `COPY public.*` streams. Only the
+  statement schema qualifiers were mapped to `core_hub`; the source has no
+  sequence statements.
+- The target rehearsal state was backed up before its rows were cleared. Its
+  archive SHA-256 is
+  `92200f21d9f9ea01023ec74dd2e64641ec14544ee5a3a024f911c81e2ed67157`.
+- Restored target counts match the frozen source: `1, 3, 10, 2, 2, 3, 2, 16`
+  across `alembic_version`, `api_consumers`, `api_keys`,
+  `hub_capability_manifests`, `hubs`, `interaction_events`, `migration_runs`
+  and `widgets`.
+- Order-independent content digests match for all eight tables. Alembic is at
+  `20260627_0002`; the post-restore migration Job completed.
+
+## Target readiness
+
+- Helm revision 3 runs chart `0.3.1` at immutable image digest
+  `sha256:0db6f7c646c6d4c1fbc844dc266fcf883584637e1c1f47802efe1c6a98558d3c`.
+- The railiance01 Deployment is Ready. The hardened package verifier passes.
+- Direct target resolution returns health/readiness 200, protected hubs 401
+  without authentication, and 200 with the governed token.
+- The Ingress is present at `92.205.62.239`. Certificate issuance is pending
+  because the IONOS A record still resolves the HTTP-01 challenge to the
+  source host.
+
+## Current rollback
+
+Before the DNS edit, rollback is:
+
+1. Roll railiance01 Helm release `core-hub` back from revision 3 to revision 2
+   to remove the target Ingress.
+2. On CoulombCore, reset database `core_hub`'s
+   `default_transaction_read_only` setting and restart Deployment
+   `core-hub-api` so the application reconnects writable.
+3. Verify public health, readiness and an authenticated protected operation.
+
+After DNS changes, restore `hub.coulomb.social` to `92.205.130.254` before
+reenabling source writes. Never allow both databases to accept production
+writes.